diff --git a/.gitignore b/.gitignore
index ab6a7a0..3946c4b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/unbound-1.25.1.tar.gz
+SOURCES/unbound-1.26.0.tar.gz
diff --git a/.unbound.metadata b/.unbound.metadata
index 28eabc3..13dba59 100644
--- a/.unbound.metadata
+++ b/.unbound.metadata
@@ -1 +1 @@
-382e12658a8c8e63ffb3edb1c6592b54a7a75ce3 SOURCES/unbound-1.25.1.tar.gz
+deb8d3e3c404bb8d4317bc78a03293cbd4ef72ca SOURCES/unbound-1.26.0.tar.gz
diff --git a/SOURCES/unbound-1.25.1.tar.gz.asc b/SOURCES/unbound-1.25.1.tar.gz.asc
deleted file mode 100644
index c115f44..0000000
--- a/SOURCES/unbound-1.25.1.tar.gz.asc
+++ /dev/null
@@ -1,14 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQGzBAABCAAdFiEEIxAYaQxNkD70GRRqoUQyPeqs30UFAmoNcTMACgkQoUQyPeqs
-30XOtQv+KDxps+HwnHZBnwz2VmapOT4N2q8TR5RN60kdmUYEBvErvskS4gQPTJ2T
-judQCvMBCF5g1tUW+744/jJRA/7tWyYPhdLveAEWa7uNrw311/pFSByLO8Do/H56
-JJwO+JPOxjiIqn98QhVgTtV+M4ljMYJpfaMt1M6ABo533yp5o56I3u6wEIiien7W
-0W37O/fYAyzlMwrfzKQyUXrUuhkwzVdZAF5kWpi+WGU7HjaLMPhr2P+q/klIzy6q
-6rYtVn1gEFSyMFxr6va2JIzwvK5cLETbNqPpbJy7EmFLqNzzPItEnjfYznOWn/TN
-D9SdTMnEieKoPpv6WuTTMAnC++VV3Xp8adka0j3e0zvaul7gwwv6Cwr17OkULyev
-OPaFQXHypKt2FVVarKiX0MrAyLelHXEPrvkGwTbnY3AouSsUtYwra10HdXlH1pHa
-lmVFOJNQMbA6YB9n5dEOyHC4j6s2H7m7HfyHgsn3XTW2cxO/QcDJTHcZaH2VG7Io
-8HSabWFf
-=jpd4
------END PGP SIGNATURE-----
diff --git a/SOURCES/unbound-1.26.0-disabled-ipsecmod-fix.patch b/SOURCES/unbound-1.26.0-disabled-ipsecmod-fix.patch
new file mode 100644
index 0000000..55148c8
--- /dev/null
+++ b/SOURCES/unbound-1.26.0-disabled-ipsecmod-fix.patch
@@ -0,0 +1,48 @@
+From f63771f3afe8a5d1f9bbb89030937e9393366dea Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Thu, 6 Aug 2026 09:46:18 +0200
+Subject: [PATCH] - Fix #1487: regression in 1.26.0, ipsecmod is now always
+ partly enabled.
+
+---
+ ipsecmod/ipsecmod.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/unbound-1.26.0/ipsecmod/ipsecmod.c b/unbound-1.26.0/ipsecmod/ipsecmod.c
+index d1c0d44..71b42f1 100644
+--- a/unbound-1.26.0/ipsecmod/ipsecmod.c
++++ b/unbound-1.26.0/ipsecmod/ipsecmod.c
+@@ -59,6 +59,11 @@
+ static int
+ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
+ {
++	if(cfg->ipsecmod_whitelist &&
++		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
++		return 0;
++	if(!cfg->ipsecmod_enabled)
++		return 1;
+ 	if(!cfg->ipsecmod_hook || (cfg->ipsecmod_hook && !cfg->ipsecmod_hook[0])) {
+ 		log_err("ipsecmod: missing ipsecmod-hook.");
+ 		return 0;
+@@ -68,9 +73,6 @@ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
+ 			cfg->ipsecmod_hook, strerror(errno));
+ 		return 0;
+ 	}
+-	if(cfg->ipsecmod_whitelist &&
+-		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
+-		return 0;
+ 	return 1;
+ }
+ 
+@@ -626,6 +628,8 @@ ipsecmod_inform_super(struct module_qstate* qstate, int id,
+ 		verbose(VERB_ALGO, "super has no ipsecmod state");
+ 		return;
+ 	}
++	if(!siq->enabled)
++		return;
+ 
+ 	if(qstate->return_msg) {
+ 		struct ub_packed_rrset_key* rrset_key = reply_find_answer_rrset(
+-- 
+2.55.0
+
diff --git a/SOURCES/unbound-1.26.0.tar.gz.asc b/SOURCES/unbound-1.26.0.tar.gz.asc
new file mode 100644
index 0000000..23735a4
--- /dev/null
+++ b/SOURCES/unbound-1.26.0.tar.gz.asc
@@ -0,0 +1,14 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCAAdFiEEIxAYaQxNkD70GRRqoUQyPeqs30UFAmpxkcIACgkQoUQyPeqs
+30WrRQwAuJbi1ZWSAQcMZ8j0MxwJryvEOV1AFtSKd3yje6DPc75QHoChed8ns2bz
+sZSFYlIVbBTccErIAhJXUfGKmRFc9sRafRDWnjaG3wZMwoEfznDCYuSIbw0CB04c
+Y4PNaPmN6ZWBJ1y0l5dPvhY0ovi5O7GhZtaFw9hjWD6/84BH1x0GG+g3LLdZ3w4b
+Um2No+xsrIY7l9NfId5T+AQhxOrER/6BNH1H1IDmyBNkEmbroEL4yb8/vt76Hyt4
+nCPoRdAEYA/vB1NDKIhgOB2kezGUWZ+uRrsjTv9oqWU2jJ1QJzm6+P/yuZEM1Jqo
+segK0inZH4ZdwAT4LJb2SXgDN/9DaaLAmaopAzafh/Qd/TsGQV+3Q82wLyXvfIHx
+EEf8u7c9630MkVytRkDOw7qruoKxUOAA8vx/9apVdreralPn4JuaNd61VyFg9dBq
+eXZA2NuAzc8V3xjgRuWmPZu77wM/oUW5C+1h+GdgmqiK+unYVLVlFt5O5AMlI7/2
+gw0p5xdo
+=3eZ6
+-----END PGP SIGNATURE-----
diff --git a/SPECS/unbound.spec b/SPECS/unbound.spec
index 8eefbc9..66d4530 100644
--- a/SPECS/unbound.spec
+++ b/SPECS/unbound.spec
@@ -30,7 +30,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.25.1
+Version: 1.26.0
 Release: 1%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: https://nlnetlabs.nl/projects/unbound/
@@ -64,6 +64,10 @@ Source27: tmpfiles-unbound-libs.conf
 
 # Downstream configuration changes
 Patch1: unbound-fedora-config.patch
+# https://github.com/NLnetLabs/unbound/commit/8b33c5d7ffb82d442f3d19021588449cd6b02a17
+# Will likely be included in unbound-1.26.1.
+Patch2: unbound-1.26.0-disabled-ipsecmod-fix.patch
+
 
 BuildRequires: gcc
 BuildRequires: make
@@ -508,6 +512,9 @@ popd
 %{_prefix}/lib/dracut/modules.d/99unbound
 
 %changelog
+* Thu Aug 06 2026 Fedor Vorobev <fvorobev@redhat.com> - 1.26.0-1
+- Update to 1.26.0
+
 * Thu Jul 02 2026 Fedor Vorobev <fvorobev@redhat.com> - 1.25.1-1
 - Update to 1.25.1 (RHEL-187020)
 - Fixes 11 CVEs: 6 Important, 5 Moderate.